We compare our detection methods to two popular open-source detectors, Local Intrinsic Dimensionality (LID) and Mahalanobis distance (M-D) detection, as described in REF . The hyperparameters for the LID methods are the batch size and the number of neighbors, as suggested in [1]} the batch size is set as 100, and the number of neighbors to 20 for CIFAR-10 and 10 for CIFAR-100. For M-D we use the whole CIFAR-10/100 training set to calculate the mean and covariance. We choose the magnitude as recommended in [2]}, individually for each attack method, \(0.002\)  for FGSM, \(0.00005\)  for Deepfool, PGD, and BIM, and \(0.0001\)  for C&W, for CIFAR-10. For CIFAR-100 we choose the magnitude to be \(0.005\)  for FGSM, \(0.0005\)  for Deepfool, \(0.01\)  for PGD, and BIM, and \(0.0001\)  for C&W.
